Dashboards & Visualizations

Why is the SDK Javascript auto_cancel expiring after 10 minutes?

faustf
Communicator

Hi guys,

I have a javascript service that performs a query every 30 seconds:

let service = new this.splunkjs.Service({
        username: process.env.SEARCHER_USERNAME,
        password: process.env.SEARCHER_PASSWORD,
        scheme: process.env.SEARCHER_SCHEME,
        host: process.env.SEARCHER_HOST,
        port: process.env.SEARCHER_PORT,
        version: process.env.SEARCHER_VERSION
    });

    // Set the search parameters
    let searchParams = {
        exec_mode: "blocking",
        auto_cancel: process.env.SEARCHER_AUTO_CANCEL_JOB_SEC,
        output_mode: "JSON",
        rf: "*"
    };

service.search(
        searchQuery,
        searchParams,
        ...
        ....
        ......

even If I set SEARCHER_AUTO_CANCEL_JOB_SEC=30, if I go to Activities/Jobs (in the Splunk Web Application) the job Expires date is 10 minutes after the Created at date. I was expecting 30 seconds not 10 minutes.

Splunk version: 6.6.2

Thank you

0 Karma

bojanisch
Path Finder

Hi @faustf,

I haven't used this SEARCHER_AUTO_CANCEL_JOB_SEC parameter yet, but if you want to reduce the expiration time of your results, limits.conf is the way to go.

See https://answers.splunk.com/answers/52973/how-to-set-search-result-no-expiration.html which answered this previously.

0 Karma

faustf
Communicator

But it will reduce the expiration time for all JOBs.
I would like to do it using the SDK and only for my JOBs.

thank you for your answer

0 Karma

bojanisch
Path Finder

Okay and have you already tried setting the TTL (time to live) of your search job? See http://docs.splunk.com/DocumentationStatic/JavaScriptSDK/1.0/splunkjs.Service.Job.html under setTTL for an example.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...